jwcrux

It seems like a decent middle ground between high interaction honeypots and full on vm's would be leveraging something like containers.

I've considered doing this before but, you know, if free time grew on trees...

The benefit of using containers is that you can blow them away after every session, they have builtin networking so you can make entire honey nets, they're dirt cheap, and sharing the configs is a no brainer.

Why would I want to use this over something like Caddy?

Not to mention that this is 1-30MB/host. Just wait until gigabit for consumers is the mainstream.

Nevermind the fact that this hostile fork explicitly disabled code signing for extensions [0] in order to meet an arbitrary shipping date [1].

[0] https://github.com/IndependentOnion/rotor-browser/commit/916...

[1] https://github.com/IndependentOnion/rotor-browser/issues/7

Looking further into the examples, it looks like they offer time scale zooming, which is sufficient for what I'm looking for.

Thanks!

How well does this handle large datasets (thousands of datapoints)?

That's a problem that, having worked mainly with Chartist, I have struggled with.

Hey there! I'm the author of this series - happy to answer any questions.

Edit: I've also had some posts about Tor that did not fall exactly under this series format but should be helpful: http://jordan-wright.com/blog/tags/tor/

Always run Elasticsearch behind an auth proxy like nginx or their Shield offering.

Wow - fantastic work! I'm glad the ES article came in handy for you ;)

I can almost promise you that if you could reach the external ES instance and exploit it - it was already exploited. They need to wipe that box and rebuild.

Overall, great writeup - thanks for sharing!

Nice! I did something similar with the San Antonio Police Department open data: http://jordan-wright.com/blog/post/2016-05-06-exploring-sapd...

This doesn't really explain what it's checking, but if you're looking for an actual checker for your HTTPS configuration, Qualys SSLLabs maintains an open source client [0] that could easily be scripted to do this exact thing.

[0] - https://github.com/ssllabs/ssllabs-scan/

I love this quote: "the plural of anecdote is not data"

I do work for Duo, and thanks for the suggestion! Much appreciated! I'll bring it up to the team.

"infected" is the industry standard. IIRC (could be making this up) gmail knows to try "infected" in password protected zips.

How often is File Locking needed? I thought that was one of the beautiful things about Git - merging de-conflicting is not only a thing, but easy to do...

Exactly. It's crappy that they are likely getting flack over this.

Chances are, it was leaked by a disgruntled employee. But the fact is that the red team started on the internal network and used tactics that would work on darn near every org these days.

Palantir is no different. The only issue is that their pentest report was leaked.

Yes, this was one of the 9+ vulns they found.

That's what happens when you compromise a site that you don't have authorization to test. You always run this risk when performing testing that isn't under the umbrella of a formal bug bounty.

Might be DNS issues? I'm with TWC and DNS isn't resolving.

Needs "Essential Debugging with print statements"

Like others have said, pre-commit hooks for linters are very helpful. Also, CI is a must.

These alone can significantly speed up code review since you can be fairly confident you won't break anything new. Then, you just have to focus on: "does this fix the issue that was found?"

Then, it's just a matter of breaking up issues into meaningful, modular tasks that can be taken care of without days of code review.

Just a heads up, the header on the security page [1] says "SSL and TSL". I see later on that you correctly say "TLS", but mistakes like that in headings don't spur confidence :)

[1] https://www.charliehr.com/security

This is awesome. I have a repo with only about 1k stars, so nowhere near the adoption of something like npm, etc.

Even on my repo, I still regularly receive issues that say "it doesn't work. Why?" With no reproducable info. These will cut the time on asking for that info and give more time back to other users or the project itself.

I'm not a JS dev, but would it be possible for a malicious actor to create a pre/post install script that looks for packages published by the current user and "worms" its way into those pre/post install scripts?

If this were possible, something like this could have the potential to infect quite a few npm modules.

There are a ton of bug bounties nowadays, but it's a nice change of pace to have a company give some data on backend stack, subdomains, and purpose of the services up front.

Great move on Uber's part!

It's important to note that in addition to the big breaches, this site also collects database dumps from paste sites such as Pastebin.

Specifically, I've been feeding logs from my twitter bot, @dumpmon, into HIBP to help build their collection of pastes. Troy is a fantastic researcher and has been awesome to work with!

gophish - https://getgophish.com.

It's awesome because it provides phishing simulation/training to everyone for free. Traditional solutions cost $$$$$, so gophish makes this type of training available to anyone regardless of security budget.

Thanks! Eventually we will have a full online demo where users can see what the product looks like without having to download it.

I guess I'm a bit confused.. it looks like MapD is a company, but I can't find an actual product to download (if it's OSS), or pricing to buy (if it's not).

All I see is a link to the whitepaper, which requests contact info. Is there anywhere to get information on the actual product itself?